Boundaries
Give a coding agent only the access the task needs
Coding adds no permission mode of its own. It runs inside the computer policy, workspace permissions, and credential-injection controls that already govern every agent computer command.
Pairing and command authorization are separate. The skill reports missing access instead of changing daemon policy.
Store a token in workspace Credentials and inject it into the single command that needs it. Values never enter the prompt.
The skill asks before destructive operations, and commits, pushes, or opens a pull request only when the task calls for it.
An agent that can run commands can intentionally read data available to that operating-system account. Redaction reduces accidental disclosure, but it cannot make an untrusted command safe.
See workspace CredentialsGive it a project and one concrete task.
Pick a paired or cloud computer, name the project, and say what done looks like.